Wikipedia:WikiProject on open proxies

From Wikipedia, the free encyclopedia
  (Redirected from Wikipedia:OP)
Jump to: navigation, search
Administration index MetaProject on open proxies (en-Wikipedia chapter)
 If you've been blocked as an open proxy, please see: Help:blocked.

The multiwiki MetaProject on open proxies seeks to identify, verify and block open proxies and anonymity network exit nodes. To prevent abuse or vandalism, only proxy checks by verified users will be accepted. All users are welcome to discuss on the talk page, report possible proxies, or request that a blocked IP be rechecked.


Proxyblock.png
Open proxies may be blocked from editing

Reporting[edit]

Please report IP addresses you suspect are open proxies below. A project member will scan or attempt to connect to the proxy, and if confirmed will block the address.

File a new report here
I. For block requests:
Verify that the following criteria has been met:
  • The IP has made abusive contributions within the past week
For unblock requests:
Verify that the following criteria has been met:
  • No current criteria
II. For block requests For unblock requests
Replace "IP" below with the IP address you are reporting.


Replace "IP" below with the IP address you are reporting.


III. Fill out the resulting page and fill-in the requested information.
IV. Save the page.

Requests[edit]

217.115.10.133[edit]

Symbol merge vote.svg – A user has requested a proxy check. A proxy checker will shortly look into the case.

217.115.10.133 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

Blocked same as above, but seems to be a tor exit node (see whois info and https://www.ccc.de/anonymizer/). Tijfo098 (talk) 06:02, 18 October 2012 (UTC)

Blocked as tor. This is a small part of a wide tor project resolving to anonymizer.ccc.de, anonymizer.hamburg.ccc.de, torXX.anonymizer.ccc.de (where XX is a number from 1 to at least 33), etc., i.e., again, the tip of an iceberg. Materialscientist (talk) 05:54, 20 October 2012 (UTC)
Indeed. A few random tests:
  • tor5.anonymizer.ccc.de -> 80.237.226.75
  • tor10.anonymizer.ccc.de -> 62.113.219.3
  • tor15.anonymizer.ccc.de -> not registered
  • tor20.anonymizer.ccc.de -> 31.172.30.3
  • tor25.anonymizer.ccc.de -> not registered
  • tor30.anonymizer.ccc.de -> 77.244.254.230
They belong to various IPSs, but all are rented out to "Chaos Computer Club e.V." Tijfo098 (talk) 06:17, 20 October 2012 (UTC)
It's a bit more tricky: you can type the url into robtext and get their ranges, but those ranges are shared and the tor takes only a small part. For example, for 217.115.10.133, only 3 nearby IPs (trial-and-error check, not 100% sure) clearly relate to tor33.anonymizer.ccc.de, many others from the range belong to something else. And as usual, such shared ranges often host other semilegal services. Materialscientist (talk) 06:21, 20 October 2012 (UTC)
The whois info in this case is more helpful: 217.115.10.128 - 217.115.10.143 (a /28 it would seem) are all registered to CCC.de, although this is indeed less than the whole 217.115.0.0/20 Netsign PA Route. So you could issue a more discerning range block to the CCC /28. In the 80.237.226.72 - 80.237.226.79 case it's a /29 that is leased by CCC (out of the whole /17 route). If we go by the 80.237 precedent, the tor node(s) are eventually moved around the range(s) CCC rents. And it looks like the same R&I banned user was the sole editor from both of these. Tijfo098 (talk) 06:59, 20 October 2012 (UTC)

Known CCC.de ranges[edit]

Tijfo098 (talk) 07:07, 20 October 2012 (UTC)

Thanks. /29 contains only 6 IPs. If you check them individually in [1] you'll find that most of them (if not all) are already blocked one way or another, or don't clearly belong to the targeted tor. Materialscientist (talk) 07:17, 20 October 2012 (UTC)
Which ones do not? Tijfo098 (talk) 07:21, 20 October 2012 (UTC)
I judge that by robtex, which shows a different server for some nearby IPs in the range. Those tors usually take about 4 IPs/range, but ranges are many. Off course, we can always rangeblock a wider range if it is inactive, but then we might get justified unblock requests. Materialscientist (talk) 07:32, 20 October 2012 (UTC)
It looks to me like the only controversy here is over the 217.115.10.135 - 217.115.10.142 range (because you blocked the lower IPs of the last /28 I listed above) The 135-142 range is listed as allocated to CCC.de in whois, but none of those IPs respond to ping (unlike the lower IPs), so it looks like there's simply no hardware behind them, just yet. Tijfo098 (talk) 08:11, 20 October 2012 (UTC)

67.142.168.22 et al[edit]

Symbol merge vote.svg – A user has requested a proxy check. A proxy checker will shortly look into the case.

67.142.168.22 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es
67.142.168.23 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es
67.142.168.25 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es
67.142.168.27 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

All 3 4 IPs' geolocation data says "Confirmed proxy server". This, combined with several suspicious edits seem to suggest that something else is in play here.—Ryulong (琉竜) 20:42, 9 November 2012 (UTC)

  • The range 67.142.168.16/28 has been blocked by User:Coren - "Webhost/server farm hosting proxies". - Mike Rosoft (talk) 20:57, 24 November 2012 (UTC)
    • Being a confirmed proxy server isn't a problem by itself. This is a very odd range to have for farming, owned by DirecPC. Dennis Brown - © Join WER 14:43, 12 December 2012 (UTC)


69.22.184.113[edit]

Symbol redirect vote.svg – A proxy check has been completed and it is now awaiting administration and close.

69.22.184.113 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

Reason: Requested unblock.--Jezebel'sPonyobons mots 20:29, 25 July 2013 (UTC)

Sooooo..... this one is an oddball. It definitely belonged to the notorious anchorfree vpn service at one point. Now however, it seems like it's been passed on to a colo/backbone company. However, that doesn't mean it isn't a proxy. There's nothing saying it's not still in posession of anchorfree, nor is there any reason an editor would normally be editing from a colocation/internet backbone IP. Sooooo, could the editor maybe provide more information on why they need to be unblocked on this IP? Sailsbystars (talk) 01:38, 26 July 2013 (UTC)
I can see the associated user has access to a regular (unblocked) IP. As such I'm going to decline to unblock the possible proxy and advise them to edit through their regular IP only.--Jezebel'sPonyobons mots 17:25, 26 July 2013 (UTC)

User talk:Ukexpat[edit]

Symbol merge vote.svg – A user has requested a proxy check. A proxy checker will shortly look into the case.

5.56.23.148 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es
62.152.39.158 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es
176.53.45.15 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es
200.53.156.244 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es
31.3.154.189 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es
62.152.39.188 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es
128.127.107.49 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es
185.25.87.20 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es
Posting not to forget, can't check myself now. Looks like VPN, all have http (80) and pptp (1723) ports open, altushost.com, but not only. Materialscientist (talk) 09:01, 26 July 2013 (UTC)

212.74.97.221[edit]

Symbol merge vote.svg – A user has requested a proxy check. A proxy checker will shortly look into the case.

212.74.97.221 - talk - edits - block - log - current blocks - Robtex - whois - Tor - Google - HTTP - Hash.es

Reason: Suspicious edits/editing from a confirmed corporate proxy.

See also[edit]

Subpages[edit]

Related pages[edit]

Chapters[edit]

Directory Directory of WikiProjects

 

Council WikiProject Council

 

Guide Guide to WikiProjects